1. Technical Field
The present disclosure relates generally to security and, more particularly, to methods and systems for computer security.
2. Description of the Related Art
With the growth of the Internet, the increased use of computers and the exchange of information between individual users poses a threat to the security of computers. Computer security attempts to ensure the reliable operation of networking and computing resources and attempts to protect information on the computer or network from unauthorized corruption, access or disclosure. Computer system(s) as referred to herein may include(s) individual computers, servers, computing resources, networks, etc., and combinations thereof.
Among the various security threats that present increasingly difficult challenges to the secure operation of computer systems are computer viruses, worms, Trojan horses, etc. Computer viruses are programs that can infect other programs by modifying them in such a way as to include a copy of themselves. Unlike computer viruses, worms do not need to infect other programs. Worms are independent programs that are capable of reproducing themselves, spreading from machine to machine across network connections, often via email.
A Trojan horse may be an executable program that appears to be desirable but is merely disguised as “friendly” and actually contains harmful code, allowing an attacker to come in through a “back door” and perform malicious actions on the computer system. Trojans prey on system vulnerabilities and may be extremely destructive, allowing attackers to monitor, administer, and/or perform any action on a computer system that the user can, just as if they were right in front of it. For a Trojan to gain access to the computer system, the user may first be induced to install the Trojan. For example, this may be done through the offering of anything that a user might find desirable via email, instant messengers, or file sharing tools (i.e., free games, movies, system enhancements, etc.). A user may download a Trojan horse program that appears to be a calculator, performing the functions of a simple pocket calculator. When the user launches the infected file, it may appear to be performing calculations and nothing more. However, it may also be performing a number of harmful actions, such as deleting files, stealing passwords, adding files, disrupting system operation, etc. In addition, the Trojan horse may be an e-mail attachment disguised as a document file, readme file, etc. If a user launches the infected file, the Trojan may initiate installation procedures and/or propagation routines.
Trojan horse programs can be introduced to a computer system by initially being planted in software repositories that many people can access, such as software bulletin boards, publicly accessible directories, file-sharing systems, such as the KaZaA network, etc. Users accessing these repositories are then tricked into copying the Trojan horse program into their own computer systems. These users then can further spread the Trojan horse by sharing the infected program with other users, most especially if the program performs a useful function and causes no immediate or obvious damage.
Users may utilize anti-virus programs in order to protect their computer systems from security threats such as Trojan horses. Anti-virus programs operate to protect from the spread of viruses by detecting the virus and isolating or removing the viral code. Examples of anti-virus software may include activity monitoring programs, scanning programs, and/or integrity checking programs. Activity monitoring programs attempt to prevent the infection of computer systems by searching for “virus-like” activity, such as, attempts to delete a file, or to write to an executable file, and may then attempt to prevent this activity from taking place. Virus scanning programs may contain a list of previously defined virus signatures, containing the binary patterns of a virus, each associated with a virus and scan the various files of a system looking for a match to a particular virus signature. If a virus is detected, the user may be notified and further steps may be taken to rid the system of the malicious code. Integrity checking programs compute a checksum value for all of the uninfected, executable files residing on the computer system and compare the computed checksum values to checksum values generated at a later time to determine if anything has changed in the file. If the checksums match, then the executable file is uninfected. However, if the checksums do not match, then the executable file may possibly be infected and steps may be taken to remove the infected file.
Anti-virus software programs may not provide a computer user with comprehensive protection against Trojans. For example, activity monitoring programs may not adequately prevent Trojan horses because it is hard for them to distinguish between a Trojan horse that, for example, is maliciously deleting a system's file, and a regular program that is supposed to delete a system's file. Virus scanning software may detect viruses present in the system, but it may do nothing to prevent them from infiltrating the system in the first place. The virus scanning software should be continuously updated in order to be effective in detecting new and modified Trojans. This not only proves to be a very tedious and time consuming task for computer users, but also may not happen often enough to provide adequate safeguards against foreign intrusions. Integrity checking programs not only do not know which viruses they are in fact detecting; but in cases where a file has been legitimately modified, they may also require the user to verify whether or not the detected executable file contains a virus. There is a window of time between when a new attack is released to the public, and when anti-virus products have signatures to detect the attack. During this window of time, the attack is given the opportunity to do its damage. Therefore, just because a user has installed and is running an anti-virus program does not necessarily mean that the user's system is no longer vulnerable to security threats.